Commit 60375541 authored by Johannes Berg's avatar Johannes Berg Committed by John W. Linville
Browse files

mac80211: validate TIM IE length 



The TIM IE must not be shorter than 4 bytes, so verify that
when parsing it.

Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent cd1658f5

net/mac80211/mlme.c

+3 −0
Original line number Diff line number Diff line
@@ -441,6 +441,9 @@ static bool ieee80211_check_tim(struct ieee802_11_elems *elems, u16 aid) 
	u8 index, indexn1, indexn2;

	struct ieee80211_tim_ie *tim = (struct ieee80211_tim_ie *) elems->tim;



	if (unlikely(!tim || elems->tim_len < 4))

		return false;



	aid &= 0x3fff;

	index = aid / 8;

	mask  = 1 << (aid & 7);